Trust
Security, in plain language
Health and safety records name real people on their worst days. Here is how Forma360 treats them, in the same plain terms as the rest of the site. That includes the part most security pages leave out: what we don't have yet.
One organisation, one boundary
Every record belongs to your organisation and is scoped to it at the data layer. A workspace can never read another workspace. Isolation is how the platform is built, not a filter applied on top.
Permissions enforced on the server
Named permission sets govern who can see and do what, and every check runs on the server. Hiding a button is never the security model. Assign someone to sites and they see those sites’ records, every site beneath them and their own work. That holds in registers, search, exports, dashboards and the assistant alike. Deactivating a person takes effect immediately, including sessions already signed in, and the platform refuses any change that would leave a workspace without an administrator.
Sign-in that resists leaked passwords
Sign in with a password or with a one-time code sent to your email. Every account can always use the code. Passwords must be at least 12 characters, are checked against known breaches when they are set, and are stored hashed. Every password change or reset emails the account holder and signs out other sessions.
Share links you control
Public share links (inspection reports, briefings) use long, unguessable tokens, are excluded from search-engine indexing, and can be revoked at any moment. Revocation is immediate.
The assistant sees what you see
The AI assistant answers only from your own workspace’s records, filtered by your own permissions. On WhatsApp, every inbound message is signature-verified and the sender is matched to their account before anything is looked up.
Telemetry without your data
Error reporting is scrubbed before it leaves the application: request bodies, cookies, query strings and access tokens are stripped, so diagnosing a fault never means exporting your records.
Encryption, backups and audit
All traffic is encrypted in transit, and the application runs on managed cloud infrastructure. Administrative activity is recorded in an audit log your administrators can review from settings, and every register exports on demand. Your records are never held hostage.
What we don’t have yet
We would rather tell you than have you discover it: single sign-on (SSO/SAML) and formal certifications such as ISO 27001 are not yet in place. If your organisation needs a security questionnaire answered before adopting, send it over. We answer them honestly.
Questions, questionnaires, disclosures
All of it goes to support@forma360.io. If you believe you have found a vulnerability, please report it there before disclosing it anywhere else. We take reports seriously and reply like humans.